Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

CWmike writes with a pointer to this ComputerWorld mention of an interesting application of Live CDs, courtesy of Florida-based regional bank CNL: "Recognizing that most consumers don't want to buy a separate computer for online banking, CNL is seriously considering making available free Ubuntu bootable 'live CD' discs in its branches and by mail. The discs would boot up Linux, run Firefox and be configured to go directly to CNL's Web site. 'Everything you need to do will be sandboxed within that CD,' [CNL CIO Jay McLaughlin] says. That should protect customers from increasingly common drive-by downloads and other vectors for malicious code that may infect and lurk on PCs, waiting to steal the user account names, passwords and challenge questions normally required to access online banking." (But what if someone slips in a stack of doctored disks?)

I actually think this is a good idea. Gives the user something physical to insert, that way they understand it. It also reduces the number of variables in the transaction process.

Hence, if you're too lazy, don't have the knowledge or it isn't economically viable to get someone in that can secure and configure your computer system, this seems like a sane alternative that makes it a bit harder for a black hat to come in and pillage your account.

I guess for those people who shut down their computers more than once a day it would be fine. For those of us who reboot about once a month and use sleep / resume the rest of the time it is a terrible idea to be rebooting all the time to do banking (maybe twice a day sometimes, but at least a couple of times a week). Why would anyone want to put up with that? Even for folks willing to accept it, the bank would inevitably get a smattering of "the wireless doesn't work on my netbook" or something (even though Ubuntu live CD's are pretty good about support they can't manage to support every device). I would be more accepting of a VM or something though than a live CD for my own use.

I'm wondering: If I'm running WIndows, and setup the bank's Linux in a VM, am I still vulnerable to windows's trojans and keyloggers ? I would guess Yes, because keystrokes go WIndows -> VM manager -> Linux VM ? Or not ?

A VM is just a program, so any keystrokes will be sent to both the VM and whatever other program feels like it needs them. What you won't have, however, is contextual information - it's not as easy to tell when you're typing in a password in the VM from the host.

2> increase from 128px squared to full client area which has click focus. Even if redraw were faster than screenshot, you'd get a view of each OSK layout paired with cursor position. The correct OSK key is either under the cursor this screenshot, or last screenshot.

From a size perspective, you can grab WSXGA screenshots at 12kb per change base (tiff group 4) and 5-7kb per frame (gif) which may have been hefty in the nineties but ma

You do realize that most if not all Virtual Machines allow you to run physical discs, right? Or that it's trivial to convert said discs into images that any VM package will accept.

It's ultimately probably a better idea to have to boot into it rather than using something else as it makes it more of a deliberate process. A bit of a pain, but more deliberate in nature. Anybody that can't figure out how to work around the reboot limitation shouldn't be doing so anyways.

If you can't trust the client, a VM is of limited use(not zero use, the union of "the set of machines with malicious Browser Helper Objects that steal banking credentials" and "the set of machines with keyloggers" is almost certainly larger than "the set of machines with keyloggers"); but once a home user box is 0wned, there is very little stopping malware#1 from inviting malwares#2-#N as the situation dictates.

At some point, at least for banks and accounts with real money in them, it will become economic to ship dedicated appliances and skip the LiveCD/reboot/hardware incompatible/etc problem entirely. There are several possibilities: Imagine, for instance, something like the Beagleboard [beagleboard.org], but stripped down(no need for that fancy CPU or most of the I/O, something cheaper can load the bank website), and locked down: sealed in a tamper evident plastic box, CPU has on die verification of the bootloader, bootloader will only load signed system image, etc. All that tivoization stuff that gets the Trusted Computing Group excited. Should be under $100, possibly even under $50, in reasonable volume and nigh impossible to crack by software means(and hard to crack by hardware means without the target noticing. It doesn't really matter much if some hobbyist manages to crack his own, with prolonged physical access, that is his business). Just plug in a monitor, ethernet cable, keyboard, and mouse, and away you go.

For the terminally clueless(no pun intended), for whom peripheral hookup is a bit daunting, there would be nothing stopping you from charging a touch more and shipping a whole netbook. Even full x86 netbooks can be found at ~$200 with fair frequency, and nasty little PDA-in-a-netbook's-body offerings have been under $100 for a while now.

If even networking is too much of a challenge, you could go the Amazon route of baking in cell access: with proper caching and/or the use of a dedicated application preloaded on the client, the amount of data transfer for most people's banking needs would be tiny(and banks love adding monthly fees, so I'm sure they could find some way to recover the cost).

If you're going to do that, then you might as well just make an intelligent crypto token that generates a sequence of numbers according to some known algorithm. The device should have a set of buttons (akin to a small PIN pad) where the user enters a known sequence of buttons on the device itself. Online bank software either queries the device directly as USB (which may introduce other security issues) or has the user enter a set of numbers from an onboard display, in addition to their username and password. A single PIN entry allows a single login session. For extra security have the user press a "confirm" button on the device and perform another verification every time money is transferred or other sensitive operations take place.

Prevents access via software keyloggers, because the buttons are on the device itself. Provides two-factor authentication, making phishing attacks a little bit tougher if done correctly. Should be reasonably cheap. And it's a lot more convenient than booting into another OS to do your banking.

The problem with this idea is it is gonna be a nightmare for support. Lets be honest folks..while Ubuntu and other Linux distros have come a loooong way on hardware support, there is still an assload of funky cheapo hardware out there that Linux isn't gonna work well with, and the kind of folks that would require this kind of help certainly aren't gonna be technical enough to run a bunch of CLI crap to get their cheap ass wireless card or other cheap shit to go. How well does Ubuntu support those funky SiS

Uhhh - wait a minute here. Ubuntu doesn't "just work"? The most problems I've had were getting video cards to work like they are supposed to. Damned ATI drops support for this card or that, then you have to jump through hoops to get your hardware acceleration.

But, if you're booting to a secure OS specifically for the purpose of doing online banking, what need is there for super graphics?

Next most common problem is the WIFI card. Whoever distributes the CD needs to ensure that 99.9% of all WIFI cards are

This is rated "funny" - but it's really not. I read a story about a credit union, in Texas I think, that found a bunch of CD's had been distributed to customers. The label claimed that they were distributed by the credit union, and that they contained software with which to securely connect to the bank. And, of course, the contents were just a trojan.

I kind of thought the story was covered here on slashdot, but I could be wrong.

The point of the LiveCD is that there it is rather difficult for hackers to compromise (owing to the physical, unalterable nature of the disk image). It has nothing to do with obscurity--the point is that each time they boot a verified, trusted disk image and then go straight to the bank's website--without a keylogger in the motherboard there aren't really any useful attack vectors.

Aye. With a static/etc/hosts to avoid DNS hijacking/mischief *, the bank making their own CA which is the only one included in the browser's configuration, and client SSL certs, you're pretty much safe.
* Downside is that of course any IP change will require new disks to be sent out.

If you're distributing your own discs, you could just use DNSSEC and include the cert needed for verification on the disk itself. Similarly, making your own CA isn't really a good plan if you want to serve customers who don't have this disc, but the disc can have no CA certs installed on it and just have the verification data for your site.

Not necessarily, there are ways of doing this, such as doing an MFS style image with signed patches downloaded as need be with a CD being provided from time to time as the patches get larger. Additionally the only meaningful difference between a BoA disc and say one from BECU would be where the homepage linked to. There's no particular reason why the discs need to be bank specific.

Aside from "branded consumer experiences" and all that stuff that gets the marketing guys excited, the one reason to make the disks bank-specific is that it makes security a lot easier.

If all the disk has to do is go to https://mybank.com/ [mybank.com] you can do all sorts of draconian but secure stuff: Disable loading any non-SSL page or element. Trust only your own cert/CA. Remove any option to approve an exception. Configure the firewall to block any and all traffic that isn't either a DNS(SEC, preferably) lookup

Don't mod me funny, I'm serious. Like maybe a $100 little book running Linux, automatically set to keep itself up to date to eliminate hundreds of millions of dollars in cybercrime. The banks would own it, maybe even lease it to you for a $2 banking fee for having an online account with them. When you don't need it anymore or switch banks, you give it back to them and they would wipe the BIOS and system and reuse it.

In fact, they could probably even make the netbook cheaper by not including a hard drive. Just boot from USB or CD, maybe even a small USB traveldrive installed internally inside the case itself. The USB ports could be removed or completely disabled, no CDROM drive included, no HDD, etc. It becomes more or less a dumb terminal whose only purpose is to connect to the bank on boot. And, in addition, sandboxed to not allow any other applications to run besides the required startup items.

Just checked and it looks like Gateway sells a $49 netbook, found it on CNETs list of netbooks when I sorted by lowest price. And, that's *consumer* price, if the banks bought in bulk they'd even be cheaper than that. If they banks told them they didn't want USB ports (except the internal one), no harddrives, etc. then it would even be cheaper. I bet they could get them for $25 or so apiece in bulk for say 1000 units. That's not much cost to essentially eliminate the wholesale highway robbery of people's accounts that's been going on. The savings would be pretty enormous. Offset that with a small lease fee like I suggested above and its a win/win for everyone involved. Not to mention it would help Gateway out of its slump.

One of the major Canadian banks (RBC) was actually giving away netbooks (eeePC 700 I believe) a little while back (to those who switched to them). With that in mind this suggestion doesn't seem that crazy. In reality, you wouldn't even need a full netbook. A small screen, minimal keyboard, network card, and very small SD card would do. Some people might even be willing to pay $100 for them if it meant they could feel safe in their online banking.

What I have had in mind for a long is something even more mobile - a credit card sized micro computer with a number pad and a simple LCD display. Sortof like a calculator.

The OS on that has the public key of the bank and it has it's own private key for the owner (and the bank the corresponding public key). Thus it could use any medium to communicate with the bank, no matter how insecure. Maybe via a USB-dongle which you attach to the PC you are using. For online banking, you just go onto the bank site, no l

The whole thing is worthless, as soon as you burn it to disk, because as soon as you do so, its now out of date - i.e, it subject to flaws. Or are you going to force the user to download all the patches everytime they run the thing? What if it needs a kernel upgrade/reboot? It'll never work?

If they do the live CD right, it should not be terribly inconvenient. Nonetheless, I think you're correct that most people won't do this - they simply won't understand the need for it. Personally, I've been doing on-line banking using a live CD for a couple of years. But then again, I'm somewhat paranoid (but only because everyone is against me 8^).

It will be inconvenient, both for the user and for the bank. Many people do not have their systems set to boot off of the optical drive by default, so the bank would be expected by the user to provide technical support for that change. In addition, users are not going to happily accept the idea that they have to stop their music, save their work in various applications, and close down their browsing sessions to reboot (a process which for many people is not a short experience) just to check their bank bal

I don't think its a question of difficulty. It would be a total pain in the rear if I had to reboot every time I wanted to get on my bank's website. Or do I keep a dedicated bank terminal ready to got at any instant?

I don't think its a question of difficulty. It would be a total pain in the rear if I had to reboot every time I wanted to get on my bank's website. Or do I keep a dedicated bank terminal ready to got at any instant?

Actually, yes, you could have a "dedicated bank terminal". Take the old PC that is getting replaced, boot from the Linux cd-rom, use it for banking, and let the family screw up the new computer with trojans and malware while you enjoy relative peace of mind. I know a few families that have gone this route. They could care less about FOSS and its philosophies or politics, they just like the practicality of the solution. This is how FOSS can make inroads to the public, through practicality, not through id

With their custom OS pre-installed, I'm sure many people would like a dedicated "secure terminal" instead of having to deal with issues in their everyday PC.Takes up much less power and is faster to boot (flash based) than an old pc. They could even try an ARM tablet or such.

Actually, 98% of the population will only shy away from something like this is they're told what the process actually is. If they are told rather that it's their "Personal Online Banking Disc", and are then given instructions to walk them through the process, most people will happily buy into it. Most people wouldn't hesitate to install an app for this purpose, so the Live CD just needs to be marketed properly.

And even fewer systems are set to automatically set to boot from CD automatically, and the options to change it are usually located in the BIOS.

Would YOU want to be their tech support guy, who would have to know how to modify the boot order on every model and make of PC or Mac that was built in the past 10 years? And heaven forbid getting a customer sets the boot order wrong, and then they can't get back into Windows when they remove the boot CD. You know damn well that they'll blame you for "breaking their

That was my first thought, but I'm also old enough to remember having to drive to the bank and wait in line. It's far more convenient to reboot with a CD in your PC than it is to go to even an ATM machine. With the proper marketing this could go a long way towards reducing online fraud.

The majority of users I have contact with resent having to enter passwords/user-verification at all. With banks they do, often at least, appreciate the value of the process. But they still take every opportunity to minimise the process, so what're these users to do when they can't have Firefox (et al) save their username/passwords?

Personally, I'm thinking they'll go back to using Windows, which can't be reasonably prevented by the institution, without cutting off a large user-base. Still, a nice -and, to me, novel- idea.

You could use token authentication and just allow the disk to keep a cookie that logs them in with minimal interaction (either nothing or a short password like their pin).

Also, just thought you might like to know... Et al. is short for et alii and translates literally as, "with others." etc. is short for et cetera and translates roughly as, "with other objects". There is a people/things distinction. So if the other stuff is people, "et al." and if the other stuff is things, "etc.".

The important question is will the entire endeavour decrease the amount lost through fraudulent OLB transactions, and if the cost (producing the disc, customer dissatisfaction of having to use them etc.) is worth it for the expected decrease in fraudulent OLB transactions. In order to understand this you'll have to analyse a whole bunch of 'what if' questions, and the one above should certainly be one of them.

(OK, sure in reality the bank might expect to see a benefit from appearing to go out of their way t

Why Ubuntu? My guess is because it's the (at the moment) most popular version of Linux (which might help the adoption of using it since many have heard the name) and tends to have great (albet not perfect) hardware driver recognition. People want to use products by names they know and even if they've never used Ubuntu there is a semi-chance they've heard of it. And calling it just plain Linux which most have heard might bring to mind the old stereotype 'Linux = Ungodly complex geek thingy'.

The problem isn't online banking per se, it is the ease with which even savvy users can be duped into fraudulent online transactions. The solution must be much more general. Also, if every place we need to do a secure online transaction requires the booting up of a LiveCD or similar, gods help us. To say the least, that is not a scalable or generalizable solution.

In theory it is a fantastic idea to promote security and virtually prevent problems. In reality, here is what you face:
1. User inertia to do this because it removes some of the convenience of online banking. Maybe Joe and Jane Smith who would be using this would be less savvy than your average computer user and still find a way to bungle things up despite this being totally sandboxed.
2. The fact that this is openly downloadable - Criminal networks can now simply obtain CNL's distro and systematically look for a weakness. A weakness with Linux is generally in order of magnitudes harder to find than Windows.
It might work if, you have a system where you must be a customer of the bank and the distro you download comes with a unique certificate tied to your identity. But the reality of online banking is that it is an inherrent security risk. But even then, it is not quite perfect.

If I was into phishing I'd build such a CD (pre-set to my spoofed bank site of course) right away and mass-mail it out to everyone with instructions on how to use it. Pick a big bank and you should get enough hits to make it worthwhile the CD printing cost!

Or, how about let's not do this? Technical "solution", social problem. Good luck...

There's a ton of unpatched vulnerabilities in IE. There's even some in Firefox (and if you start adding plug ins, which you have to do to use the web, there's lots). I've gotten viruses from embedded PDFs in youtube comments.

Especially since the technology for building your own pre-owned version of Ubuntu, writing it to a CD-ROM and then printing a bank logo on it is very complicated and expensive and thus completely out of reach of all but the most well funded banks and governments, so we won't ever see anyone tampering with this process.

Microsoft has cut a deal with China Construction Bank, [wikipedia.org] the second largest bank in the world [by market capitalization.]

Microsoft China on March 23 inked a MoU with China Construction Bank, the nation's biggest real estate and mortgage lender, on strategic cooperation.

Under the MoU, both sides will build a new generation online banking IE browser on the base of Windows Internet Explorer. In addition, they will jointly solve problems regarding to certificate management, browser safety monitor system allocati

Unless they plan on sending you a new Live CD every time a new Firefox or Linux kernel security bug is patched, many users would be vulnerable to attacks within a few months of this CD being released. A smart phisher will eventually construct an effective "man in the middle" style style attack using whatever security holes are discovered, and the bank would probably take at least a week to develop, test, and ship new CD's that have the issue patched.

Unless they plan on sending you a new Live CD every time a new Firefox or Linux kernel security bug is patched, many users would be vulnerable to attacks within a few months of this CD being released.

Er, no. If you've got a distro with no open ports, firewalled as well, that can only get to a single IP address on port 443, which doesn't let you connect unless the remote server's SSL cert is signed by the bank's CA which is the only one in your browser's CA list - where does the vulnerability come from?

this would be a reasonable use for a trusted computing platform. It is ironic that the big companies discredited the method by not protecting the user and his rights but getting wet dreams about doing drm (and then fucking it up even for the people willing to live with it).

Seriously. Booting from a CD without an additional authentication mechanism does not solve the problem. Ii is just a fix to the fact that on nowadays computers, the way which code gets installed in the system is still an pretty undefined

If the banks simply created a custom disk for every customer, that included things like passwds, accounting software, etc. It would not be such a pain and people would try it. The feeling of security that the bank and the customer would get out of it would be worth it.

The only downside is that the disk itself could be stolen, but then so can your bank card or visa. The other obvious problem is that people may think that the reason the disk is safe is because it's Ubuntu and just install it on disk, and t

If you are going to go to the expense of creating and distributing physical media, just implement two-factor authentication.

SECURITY NERD RAGE! RAUGH!

In my opinion, pressing a little button on your bank-branded, credit card-sized PIN generator (such as the ones I have from Bank of America and PayPal/eBay) you keep in your wallet next to your credit cards and ID is waaaay easier than trying to remember what bullshit answer I gave to yet another off the wall "security" question. It's clearly much more secure.

My Dutch bank ING uses my cellphone for authorization of transactions or changes online. I can log in and view my account data with just a password, so that might get compromised, but for a transaction or for instance changing over to a new cellphone number, I need a transaction number that is being sms-ed to the cellphone.
My other Dutch bank ABN/AMRO uses some kind of calculator thingy that provides a transaction number based on a value you receive from the banks webpage.
The same ING bank also provides a very simple system where you have a sheet of paper with transaction numbers, and the webpage just asks you for your next TAN code.

What do all these have in common? Right, a separate transaction authorization outside the browser. How hard is that?

I thought the same thing, but a virtual instance may still be susceptible to things like key logging. The embedded OS wouldn't have to be Windows, it could still be a read-only Linux distribution like the Live CD.

Among the several distinct ways to alter Knoppix, the one likely to be of broadest interest is remastering [ibm.com], during which you can substitute your own software for a portion of that on the standard Knoppix CD-ROM